Chapter 1. Tutorial: Updating component routes with custom domains and TLS certificates

Procedure

1. Log in to your cluster using an account with cluster-admin privileges.

2. Configure an environment variable for your cluster name:

   $ export CLUSTER_NAME=$(oc get infrastructure cluster -o=jsonpath="{.status.infrastructureName}"  | sed 's/-[a-z0-9]\{5\}$//')
   $ export CLUSTER_ID=$(oc get clusterversion version -o jsonpath='{.spec.clusterID}')

Procedure

1. Verify that you can reach the component routes on their default hostnames. You can find the hostnames by querying the lists of routes in the openshift-console and openshift-authentication projects.

   $ oc get routes -n openshift-console
   $ oc get routes -n openshift-authentication

   Example output

   NAME        HOST/PORT                                                                          PATH       SERVICES    PORT    TERMINATION          WILDCARD
   console     console-openshift-console.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com    ... 1 more  console    https   reencrypt/Redirect   None
   downloads   downloads-openshift-console.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com  ... 1 more  downloads  http    edge/Redirect        None
   NAME              HOST/PORT                                                             PATH        SERVICES          PORT   TERMINATION            WILDCARD
   oauth-openshift   oauth-openshift.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com ... 1 more  oauth-openshift   6443   passthrough/Redirect   None

   By running these commands you can see that the default component routes for your cluster are:

   • console-openshift-console.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com for Console
   • downloads-openshift-console.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com for Downloads

   • oauth-openshift.apps.my-example-cluster-gcp.<cluster_id>.openshiftapps.com for OAuth

     From this output you can see that your base hostname is <cluster_id>.openshiftapps.com.

2. Get the ID of the default ingress by running the following command:

   $ export INGRESS_ID=$(ocm list ingresses -c ${CLUSTER_NAME} | awk '$4 == "true" {print $1}')

3. Ensure all fields output correctly before moving to the next section:

   $ echo "Ingress ID: ${INGRESS_ID}"

   Example output

   Ingress ID: r3l6

4. Use the ocm edit ingress command to change the hostname of each service and add a TLS certificate for all of your component routes. This excerpt of the command-line help for the ocm edit ingress command shows the relevant parameters:

   $ ocm edit ingress -h
   Edit a cluster ingress for a cluster. Usage:
     ocm edit ingress ID [flags]
     [...]
     --component-routes string                Component routes settings. Available keys [oauth, console, downloads]. For each key a pair of hostname and tlsSecretRef is expected to be supplied. Format should be a comma separate list 'oauth: hostname=example-hostname;tlsSecretRef=example-secret-ref,downloads:...'

Procedure

1. Retrieve the IP address of the load balancer by running the following command, using the namespace for the load balancer:

   $ oc get svc -n <namespace>

   The load balancer IP of the load balancer is the EXTERNAL-IP associated with the router-default service in the openshift-ingress namespace.

   Example output

   $ oc get svc -n openshift-ingress
   NAME            TYPE          CLUSTER-IP     EXTERNAL-IP        PORT(S)                     AGE
   router-default  LoadBalancer  172.30.237.88  203.0.113.10      80:31175/TCP,443:31554/TCP  76d

   In this example, the load balancer IP is 203.0.113.10.

2. Save this value for later, as you need it to configure DNS records for your new component route hostnames.
3. Create an A record in your DNS settings, pointing the domain to the IP address of the load balancer for router-default.

Procedure

1. Use the ocm edit ingress command to update your default ingress route with the new base domain and the secret reference associated with it, and update the hostnames for each component route.

   $ ocm edit ingress -c ${CLUSTER_NAME} ${INGRESS_ID} --component-routes 'console: hostname=console.my-new-domain.dev;tlsSecretRef=console-tls,downloads: hostname=downloads.my-new-domain.dev;tlsSecretRef=downloads-tls,oauth: hostname=oauth.my-new-domain.dev;tlsSecretRef=oauth-tls'

   Note

   You can also edit only a subset of the component routes by leaving the component routes you do not want to change set to an empty string. For example, if you only want to change the Console and OAuth server hostnames and TLS certificates, you would run the following command:

   $ ocm edit ingress -c ${CLUSTER_NAME} ${INGRESS_ID} --component-routes 'console: hostname=console.my-new-domain.dev;tlsSecretRef=console-tls,downloads: hostname="";tlsSecretRef="", oauth: hostname=oauth.my-new-domain.dev;tlsSecretRef=oauth-tls'

2. Run the ocm list ingress command to verify your changes:

   $ ocm list ingress -c ${CLUSTER_NAME} -ojson | jq ".[] | select(.id == \"${INGRESS_ID}\") | .component_routes"

   Example output

   {
     "console": {
       "kind": "ComponentRoute",
       "hostname": "console.my-new-domain.dev",
       "tls_secret_ref": "console-tls"
     },
     "downloads": {
       "kind": "ComponentRoute",
       "hostname": "downloads.my-new-domain.dev",
       "tls_secret_ref": "downloads-tls"
     },
     "oauth": {
       "kind": "ComponentRoute",
       "hostname": "oauth.my-new-domain.dev",
       "tls_secret_ref": "oauth-tls"
     }
   }